fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-18233

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

WordPress Appointment Booking Calendar Plugin and Scheduling Plugin plugin 1.5.6-1.6.2 - Unauthenticated Booking Price Manipulation vulnerability

Unauthenticated Booking Price Manipulation vulnerability discovered by Nguyen Phuoc Thinh - HPT Vietnam Corporation in WordPress Plugin BookingPress versions 1.5.6-1.6.2...

CVE-2026-76586 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-76586 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions 1.5.6-1.6.2 ) is vulnerable to an unauthenticated booking price manipulation via PayPal payment confirmation. The root cause is a failure to verify the amount actually paid against the server-side staged price d...

CVE-2026-18234

The MStore API WordPress plugin (versions before 4.21.1 ) contains a vulnerability where it fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, the plugin fails to deduct the wallet balance for most payment methods. This allows any authenti...

CVE-2026-16947

The Total processing card payments for WooCommerce WordPress plugin (versions through 7.3 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied path used to build a server-side verification request and the lack of auth...

EUVD-2026-67959

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

PT-2026-83497

Name of the Vulnerable Software and Affected Versions Custom User Registration Fields for WooCommerce versions prior to 2.2.4 Description An issue allows unauthenticated attackers to elevate their privileges to Administrator. This occurs because the plugin accepts an attacker-controlled afreg...

PT-2026-83400

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, it does not deduct the wallet balance for most payment...

Unity Linux 20.1070e Security Update: runc (UTSA-2026-104944)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104944 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and...

PT-2026-83452

Name of the Vulnerable Software and Affected Versions KubeEdge CloudCore versions prior to 1.23.2 Description The HTTPS server in CloudCore accepts node task status reports without authentication verification. An attacker can access CloudCore on port 10002 to manipulate the status of upgrade jobs...

CVE-2026-55841

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...

Inappropriate Encoding for Output Context

Overview Affected versions of this package are vulnerable to Inappropriate Encoding for Output Context in the connection process. An attacker can cause silent data corruption and potentially bypass input sanitization by manipulating the character set mid-session, leading to a mismatch between...

CVE-2026-3627

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...

CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...